CVE-2020-1456: 
vulnerability analysis and mitigation

A cross-site-scripting (XSS) vulnerability (CVE-2020-1456) was discovered in Microsoft SharePoint Server, where the server fails to properly sanitize specially crafted web requests. The vulnerability affects multiple versions of SharePoint Server including SharePoint Enterprise Server 2013 SP1, 2016, SharePoint Server 2010 SP2, and 2019. This vulnerability was disclosed in July 2020 and is unique from related vulnerabilities CVE-2020-1450 and CVE-2020-1451 (NVD).

The vulnerability stems from improper neutralization of user input during web page generation, specifically in the profile picture functionality. When users upload profile pictures, the SharePoint server inadequately validates the parameter 'ctl00$PlaceHolderMain$ProfileEditorEditPictureURL' in the save dialog-request, allowing arbitrary links to be inserted instead of legitimate image paths. The vulnerability has been assigned a CVSS v3.1 Base Score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (SlashCrypto, NVD).

The vulnerability can be exploited to conduct various attacks including Denial of Service (DoS) through embedding links to large files, user tracking through referrer headers (potentially violating GDPR), internal path disclosure due to IIS default settings, and attack relaying where malicious links are automatically executed by users visiting pages with embedded profile pictures. The vulnerability could also be used to cause reputation damage by embedding links to inappropriate content that would be flagged by company security systems (SlashCrypto).

The vulnerability requires authentication and user interaction for successful exploitation. An attacker must first have a valid SharePoint account to upload a profile picture and manipulate the image URL. The exploit has been documented and demonstrated, showing how an attacker can modify the profile picture URL parameter during the save request to insert malicious links (SlashCrypto).

Microsoft has released security updates to address this vulnerability. The fixes are available through Microsoft's security advisory and should be applied to affected SharePoint installations. The patches are available for SharePoint Enterprise Server 2013 SP1, 2016, SharePoint Server 2010 SP2, and 2019 (MSRC).